INJUNCTIVE RELIEF; CIVIL PENALTY.

(a) The attorney general may institute an action for injunctive relief to restrain a violation of this chapter.

(b) In addition to the injunctive relief provided by Subsection (a), the attorney general may institute an action for civil penalties against a covered entity for a violation of this chapter. A civil penalty assessed under this section may not exceed:

(1) $5,000 for each violation that is committed negligently and that occurs in a single year, regardless of how long the violation continues during that year;

(2) $25,000 for each violation that is committed knowingly or intentionally and that occurs in a single year, regardless of how long the violation continues during that year; or

(3) $250,000 for each violation in which the covered entity knowingly or intentionally used protected health information for financial gain.